Replace HaaLeo/publish-vscode-extension with inline publish steps

[zackverham]

Summary

• Removes the dependency on HaaLeo/publish-vscode-extension@v2 (a Node.js-based action with runtime version constraints)
• Replaces it with inline bash steps that call @vscode/vsce and ovsx directly via npx
• Auth is handled via environment variables (VSCE_PAT / OVSX_TOKEN) which is how both tools natively authenticate

Proves the viability of posit-dev/posit-gh-actions#2 - which would expose a common drop-in replacement GHA for the HaaLeo dependency.

[posit-connect-projects]

Claude finished @zackverham's task in 1m 37s —— View job

---

Code Review

• Reading the changed workflow file
• Analyzing the implementation
• Providing code review feedback

---

Overall: Good approach to remove the third-party action dependency. The inline bash implementation is more transparent and gives you direct control over the tooling versions. However, there's one bug that needs to be fixed before merging.

Bug: Incorrect environment variable for Open VSX authentication

The ovsx CLI expects the token in an environment variable named OVSX_PAT, but the workflow sets OVSX_TOKEN:

# Line 74-75 - Current (incorrect)
env:
  OVSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}

From the ovsx documentation:

You can either pass the token via the --pat (or -p) argument, or put it into an environment variable named OVSX_PAT.

Fix: Rename the environment variable to OVSX_PAT:

env:
  OVSX_PAT: ${{ secrets.OPEN_VSX_TOKEN }}

Fix this →

What looks good

1. Robust shell scripting - Using set -euo pipefail ensures the script fails fast on errors
2. Defensive validation - Checking the extension file exists before publishing prevents confusing downstream errors
3. Proper error annotations - Using ::error:: syntax provides clear visibility in the GitHub Actions UI
4. Version pinning strategy - Pinning to major versions (@vscode/vsce@2, ovsx@0) balances stability with security patches
5. VS Marketplace auth is correct - VSCE_PAT is the right environment variable name for @vscode/vsce

Nit (optional)

The EXTENSION_FILE variable could be removed and replaced with direct use of the step output:

run: |
  set -euo pipefail
  ext_file="${{ steps.get-extension-path.outputs.extension_path }}"
  if [[ ! -f "$ext_file" ]]; then
    echo "::error::extensionFile not found at: $ext_file"
    exit 1
  fi
  npx --yes @vscode/vsce@2 publish --packagePath "$ext_file" --skip-duplicate

This is purely stylistic - the current approach with env: is equally valid and perhaps more readable.

---

[zackverham]

@claude can you fix the issues you identified in code review above

[posit-connect-projects]

Claude finished @zackverham's task in 42s —— View job

---

Fixing code review issues

• Read the current workflow file
• Fix OVSX_TOKEN → OVSX_PAT environment variable
• Commit and push the fix — blocked by permissions

---

I made the fix locally (renaming OVSX_TOKEN to OVSX_PAT on line 74 of .github/workflows/publish.yaml), but I'm unable to push it because the GitHub App doesn't have workflows permission to modify files in .github/workflows/.

You can apply this one-line fix manually:

--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -71,7 +71,7 @@ jobs:
 
       - name: Publish to Open VSX Registry
         env:
-          OVSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}
+          OVSX_PAT: ${{ secrets.OPEN_VSX_TOKEN }}
           EXTENSION_FILE: ${{ steps.get-extension-path.outputs.extension_path }}

The ovsx CLI authenticates via the OVSX_PAT environment variable — OVSX_TOKEN is not recognized, so publishing to Open VSX would silently fail or error without this fix.

[dotNomad]

Could we use @3? Not sure if the CLI has changed much.

[zackverham]

Done — bumped to @vscode/vsce@3 (latest is 3.9.1). The CLI interface is the same for our usage (publish --packagePath ... --skip-duplicate).

[zackverham]

(claude wrote this, but useful breadcrumb)

[dotNomad]

This looks good, but I think we should investigate the version bumps